How to turn off NTLM and use Kerberos only

Question

Our cyber security team has asked us to start researching a way to turn off NTLM communication. We noticed that adaxes is using NTLM. Is there a way to force kerberos authentication only for the service?

Answer 1

Hello Mark,

As we understand, you mean NTLM being used for communication between Adaxes service and Web interface. If that is correct, you can force using Kerberos perform the below steps on each computer where Adaxes Web interface is installed:

1. Navigate to the folder where Adaxes Web interface is installed, which is C:\Program Files\Softerra\Adaxes 3\Web Interface by default.

2. Open the App folder.

3. Open the Softerra.Adaxes.Adsi.dll.config file with a text editor.

4. Locate the application/channels/channel XML element.

5. Set the servicePrincipalName parameter to Adaxes/<service_FQDN>, where <service_FQDN> is the fully qualified domain name of any computer where your Adaxes service is installed.

    <application>
        <channels>
            <channel ref="tcp" priority="2" secure="true" servicePrincipalName="Adaxes/myadaxesservice.company.com">
                ...
            </channel>
        </channels>
    </application>

   • If you have multiple instances of Adaxes Web interface, specify the same computer name for each Web interface.
   • If you have multiple instances of Adaxes service sharing common configuration in the same AD site, they should all have the same Adaxes service account.

6. Save the file.

Also, you need to register the service principal name for your Adaxes service:

1. On any computer where Adaxes service is installed, launch the command prompt.

2. Type the following command and press Enter:

    setspn -U -A Adaxes/<service_FQDN> <DOMAIN\username>

   In the command:

   • <service_FQDN> - The fully qualified domain name of the computer where Adaxes service is installed.
   • <DOMAIN\username> - The username of the Adaxes service account.

If you have multiple instances of Adaxes service sharing common configuration:

• All instances of Adaxes service must use the same service account.
• You need to register the service principal name only for one instance of Adaxes service in the configuration set.

Comments

Is it sufficient to just edit the Softerra.Adaxes.Adsi.dll.config file or is it necessary to complete all the steps outlined in the how-to article Enable trust for delegation for web servers for this to work?

---

Hello,

The steps outlined in the article are only required when you enable auto-logon for Adaxes Web interface that is installed on a different computer then Adaxes service. To force using Kerberos, you just need to update the file as we referenced above.